An AR/VR headset fuses several raw sensor streams — a depth/spatial-mapping camera that scans the room into a 3D point cloud, and an inward eye-tracking camera sampling gaze direction at ~90–120 Hz. Both are genuinely needed for good AR (occlusion, physics, foveated rendering) — but handed to an app unfiltered, each becomes a privacy channel:
exposure = base(API) × (1 − trust/100) × (1 − mitigation/100) × (1 − 0.9·boundary)
attackSurface = 0.45 × roomLeak + 0.55 × gazeID (0–100)
- Spatial-mapping leak — a raw room point cloud reveals floor plan, furniture, screens, even documents on a desk to any app that requests the depth API, regardless of what the app is nominally for.
- Gaze biometric identifiability — published eye-tracking research (e.g. Stanford's VR gaze-authentication studies) shows a person's saccade dynamics and fixation micro-timing are distinctive enough to re-identify them from well under a minute of gaze data — gaze is treated as a biometric, not just an input signal, and it carries weight 0.55 here because it degrades far less under trust alone.
- Trust level — how much an app is nominally vetted (store review, code signing); it helps, but a "trusted" app that still receives the raw stream can be compromised or simply misuse the data, so trust alone never reaches zero exposure.
- On-device mitigation — differential-privacy noise injection and spatial-mesh coarsening applied before data ever leaves the device; this is the strongest lever against both channels.
- Compositor boundary — the OS renders the final composited frame itself and hands the app only that image, never the raw camera/depth buffer — the dominant real-world mitigation in shipping AR/VR platforms (visionOS, Quest) — cutting exposure by ~90%.
The 3D view shows the scanned room as a point cloud (purple = protected, red = leaking to the app) and a live gaze trail on the headset's view plane (brighter/longer = more identifying data being streamed out).